@curless/agentbank-core 0.0.2 → 0.1.1

package/dist/encoding.d.ts

@@ -0,0 +1,4 @@
+export declare const toBase64: (s: string) => string;
+export declare const toBase64Url: (s: string) => string;
+export declare const fromBase64: (b64: string) => string;
+//# sourceMappingURL=encoding.d.ts.map

package/dist/encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../src/encoding.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,KAAG,MAMpC,CAAC;AAGF,eAAO,MAAM,WAAW,GAAI,GAAG,MAAM,KAAG,MACgC,CAAC;AAKzE,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,KAAG,MAMxC,CAAC"}

package/dist/encoding.js

@@ -0,0 +1,30 @@
+// Portable base64 / base64url for every runtime the SDKs target: Node has
+// Buffer; Workers / Deno / edge have atob + btoa + TextEncoder/Decoder. One
+// implementation here so the buyer / merchant / protocol packages encode
+// identically instead of each shipping its own guarded copy (which is how
+// protocols-sdk ended up with an unguarded Buffer that crashed on Workers).
+const hasBuffer = typeof Buffer !== 'undefined';
+// utf8 string → standard base64.
+export const toBase64 = (s) => {
+    if (hasBuffer)
+        return Buffer.from(s, 'utf8').toString('base64');
+    const bytes = new TextEncoder().encode(s);
+    let bin = '';
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin);
+};
+// utf8 string → base64url, unpadded — for tokens and wire credentials.
+export const toBase64Url = (s) => toBase64(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+// base64 (standard OR url-safe) → utf8 string. Throws on malformed input on
+// edge runtimes (atob); Node's Buffer is lenient, matching the prior per-
+// package behaviour. Accepting url-safe input too means one decoder for both.
+export const fromBase64 = (b64) => {
+    const std = b64.replace(/-/g, '+').replace(/_/g, '/');
+    if (hasBuffer)
+        return Buffer.from(std, 'base64').toString('utf8');
+    const bin = atob(std);
+    const bytes = Uint8Array.from(bin, (ch) => ch.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+};
+//# sourceMappingURL=encoding.js.map

package/dist/encoding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../src/encoding.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;AAEhD,iCAAiC;AACjC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE;IAC5C,IAAI,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAS,EAAU,EAAE,CAC/C,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAEzE,4EAA4E;AAC5E,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAU,EAAE;IAChD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC,CAAC"}

package/dist/errors.d.ts

@@ -3,5 +3,6 @@ export declare class AgentbankError extends Error {
     readonly code: string;
     readonly details?: unknown;
     constructor(status: number, code: string, message: string, details?: unknown);
+    static is(err: unknown): err is AgentbankError;
 }
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAOA,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAEf,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAO7E"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAOA,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAEf,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;IAc5E,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,cAAc;CAQ/C"}

package/dist/errors.js

@@ -16,5 +16,17 @@ export class AgentbankError extends Error {
         this.code = code;
         this.details = details;
     }
+    // Cross-version-safe type guard. `instanceof` silently fails when two copies
+    // of @curless/agentbank-core coexist in one node_modules (e.g. a consumer on
+    // core@0.1.0 and an SDK that pinned core@0.0.x) — they're different class
+    // objects. This checks the shape instead, so an error from ANY core version
+    // is recognized. Prefer `AgentbankError.is(err)` over `err instanceof` at
+    // package boundaries.
+    static is(err) {
+        return (err instanceof Error &&
+            err.name === 'AgentbankError' &&
+            typeof err.code === 'string' &&
+            typeof err.status === 'number');
+    }
 }
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,qEAAqE;AACrE,sDAAsD;AACtD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,qDAAqD;AACrD,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,MAAM,CAAS;IACf,IAAI,CAAS;IACb,OAAO,CAAW;IAE3B,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,OAAiB;QAC1E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,qEAAqE;AACrE,sDAAsD;AACtD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,qDAAqD;AACrD,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,MAAM,CAAS;IACf,IAAI,CAAS;IACb,OAAO,CAAW;IAE3B,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,OAAiB;QAC1E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,sBAAsB;IACtB,MAAM,CAAC,EAAE,CAAC,GAAY;QACpB,OAAO,CACL,GAAG,YAAY,KAAK;YACpB,GAAG,CAAC,IAAI,KAAK,gBAAgB;YAC7B,OAAQ,GAA+B,CAAC,IAAI,KAAK,QAAQ;YACzD,OAAQ,GAA+B,CAAC,MAAM,KAAK,QAAQ,CAC5D,CAAC;IACJ,CAAC;CACF"}

package/dist/http.d.ts

@@ -5,8 +5,15 @@ export type RequestOptions = {
     body?: unknown;
     idempotencyKey?: string;
     skipAuth?: boolean;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+};
+export declare const DEFAULT_TIMEOUT_MS = 30000;
+export type SendJsonOptions = {
+    signal?: AbortSignal;
+    timeoutMs?: number;
 };
 export declare const buildUrl: (baseUrl: string, path: string, query?: RequestOptions["query"]) => string;
 export declare const toError: (status: number, json: unknown) => AgentbankError;
-export declare const sendJson: <T>(fetchImpl: FetchLike, url: string, method: string, headers: Record<string, string>, body: unknown) => Promise<T>;
+export declare const sendJson: <T>(fetchImpl: FetchLike, url: string, method: string, headers: Record<string, string>, body: unknown, opts?: SendJsonOptions) => Promise<T>;
 //# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAO7C,MAAM,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAGF,eAAO,MAAM,QAAQ,GACnB,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,QAAQ,cAAc,CAAC,OAAO,CAAC,KAC9B,MAQF,CAAC;AAIF,eAAO,MAAM,OAAO,GAAI,QAAQ,MAAM,EAAE,MAAM,OAAO,KAAG,cAiBvD,CAAC;AAKF,eAAO,MAAM,QAAQ,GAAU,CAAC,EAC9B,WAAW,SAAS,EACpB,KAAK,MAAM,EACX,QAAQ,MAAM,EACd,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,MAAM,OAAO,KACZ,OAAO,CAAC,CAAC,CAqBX,CAAC"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAO7C,MAAM,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,MAAM,CAAC,EAAE,WAAW,CAAC;IAGrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAMF,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAGF,eAAO,MAAM,QAAQ,GACnB,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,QAAQ,cAAc,CAAC,OAAO,CAAC,KAC9B,MAQF,CAAC;AAIF,eAAO,MAAM,OAAO,GAAI,QAAQ,MAAM,EAAE,MAAM,OAAO,KAAG,cAiBvD,CAAC;AAUF,eAAO,MAAM,QAAQ,GAAU,CAAC,EAC9B,WAAW,SAAS,EACpB,KAAK,MAAM,EACX,QAAQ,MAAM,EACd,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,MAAM,OAAO,EACb,OAAM,eAAoB,KACzB,OAAO,CAAC,CAAC,CA+DX,CAAC"}

package/dist/http.js

@@ -1,4 +1,9 @@
 import { AgentbankError } from './errors.js';
+// A payment API client must never hang forever on a stalled server — a stuck
+// request looks identical to "charge in flight" to the caller. 30s is generous
+// for every agentbank route (the slowest are rail captures) while still
+// bounding the worst case.
+export const DEFAULT_TIMEOUT_MS = 30_000;
 // Build a fully-qualified URL with query params (undefined values dropped).
 export const buildUrl = (baseUrl, path, query) => {
     const url = new URL(`${baseUrl}${path}`);
@@ -28,12 +33,53 @@ export const toError = (status, json) => {
 // Send a JSON request, parse the JSON response, and throw AgentbankError on a
 // non-2xx. Headers (incl. auth) are built by the caller. Body is JSON-encoded
 // unless undefined.
-export const sendJson = async (fetchImpl, url, method, headers, body) => {
-    const res = await fetchImpl(url, {
-        method,
-        headers,
-        body: body === undefined ? undefined : JSON.stringify(body),
-    });
+//
+// EVERY failure leaves here as AgentbankError — HTTP errors with their real
+// status, and transport-level failures with status 0 and a discriminating
+// code ('timeout' | 'aborted' | 'network_error'). One catch type for SDK
+// consumers; `error.status === 0` means "no HTTP response happened".
+export const sendJson = async (fetchImpl, url, method, headers, body, opts = {}) => {
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    // Combine the caller's signal with the deadline by hand — AbortSignal.any
+    // needs Node 20.3+, and this package targets Node 18 + edge runtimes.
+    const ctrl = new AbortController();
+    const onCallerAbort = () => ctrl.abort();
+    if (opts.signal) {
+        if (opts.signal.aborted)
+            ctrl.abort();
+        else
+            opts.signal.addEventListener('abort', onCallerAbort, { once: true });
+    }
+    let timedOut = false;
+    const timer = timeoutMs > 0
+        ? setTimeout(() => {
+            timedOut = true;
+            ctrl.abort();
+        }, timeoutMs)
+        : undefined;
+    let res;
+    try {
+        res = await fetchImpl(url, {
+            method,
+            headers,
+            body: body === undefined ? undefined : JSON.stringify(body),
+            signal: ctrl.signal,
+        });
+    }
+    catch (err) {
+        if (timedOut) {
+            throw new AgentbankError(0, 'timeout', `request timed out after ${timeoutMs}ms: ${method} ${url}`);
+        }
+        if (opts.signal?.aborted) {
+            throw new AgentbankError(0, 'aborted', 'request aborted by caller');
+        }
+        throw new AgentbankError(0, 'network_error', `request failed before a response: ${err.message}`, { cause: String(err) });
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        opts.signal?.removeEventListener('abort', onCallerAbort);
+    }
     const text = await res.text();
     // Parse defensively: a non-2xx upstream (a gateway 502 HTML page, a proxy
     // error, an empty body) often isn't JSON. Don't let JSON.parse throw a raw

package/dist/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAkB7C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,OAAe,EACf,IAAY,EACZ,KAA+B,EACvB,EAAE;IACV,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC,CAAC;AAEF,6EAA6E;AAC7E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,IAAa,EAAkB,EAAE;IACvE,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAgC,CAAC;YAC7C,OAAO,IAAI,cAAc,CACvB,MAAM,EACN,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,EACzB,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,gBAAgB,CAAC,EACrC,CAAC,CAAC,OAAO,CACV,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,8BAA8B,MAAM,EAAE,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF,8EAA8E;AAC9E,8EAA8E;AAC9E,oBAAoB;AACpB,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAC3B,SAAoB,EACpB,GAAW,EACX,MAAc,EACd,OAA+B,EAC/B,IAAa,EACD,EAAE;IACd,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM;QACN,OAAO;QACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,OAAO,IAAS,CAAC;AACnB,CAAC,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAuB7C,6EAA6E;AAC7E,+EAA+E;AAC/E,wEAAwE;AACxE,2BAA2B;AAC3B,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAOzC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,OAAe,EACf,IAAY,EACZ,KAA+B,EACvB,EAAE;IACV,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC,CAAC;AAEF,6EAA6E;AAC7E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,IAAa,EAAkB,EAAE;IACvE,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAgC,CAAC;YAC7C,OAAO,IAAI,cAAc,CACvB,MAAM,EACN,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,EACzB,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,gBAAgB,CAAC,EACrC,CAAC,CAAC,OAAO,CACV,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,8BAA8B,MAAM,EAAE,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF,8EAA8E;AAC9E,8EAA8E;AAC9E,oBAAoB;AACpB,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,yEAAyE;AACzE,qEAAqE;AACrE,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAC3B,SAAoB,EACpB,GAAW,EACX,MAAc,EACd,OAA+B,EAC/B,IAAa,EACb,OAAwB,EAAE,EACd,EAAE;IACd,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,IAAI,CAAC,KAAK,EAAE,CAAC;;YACjC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,KAAK,GACT,SAAS,GAAG,CAAC;QACX,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;YACd,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC,EAAE,SAAS,CAAC;QACf,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACzB,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3D,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CACtB,CAAC,EACD,SAAS,EACT,2BAA2B,SAAS,OAAO,MAAM,IAAI,GAAG,EAAE,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,cAAc,CACtB,CAAC,EACD,eAAe,EACf,qCAAsC,GAAa,CAAC,OAAO,EAAE,EAC7D,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CACvB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,OAAO,IAAS,CAAC;AACnB,CAAC,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { hmacSha256Hex, randomHex, timingSafeEqualHex } from './crypto.js';
+export { fromBase64, toBase64, toBase64Url } from './encoding.js';
 export { AgentbankError } from './errors.js';
-export { type FetchLike, type RequestOptions, buildUrl, sendJson, toError } from './http.js';
+export { DEFAULT_TIMEOUT_MS, type FetchLike, type RequestOptions, type SendJsonOptions, buildUrl, sendJson, toError, } from './http.js';
 export type { BalanceTransaction, Customer, CustomerStatus, LedgerEntryView, Paginated, PaymentIntent, PaymentIntentLedger, PaymentIntentStatus, PaymentLink, PaymentLinkItem, PaymentLinkStatus, PaymentProtocol, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7F,YAAY,EACV,kBAAkB,EAClB,QAAQ,EACR,cAAc,EACd,eAAe,EACf,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,QAAQ,EACR,QAAQ,EACR,OAAO,GACR,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,kBAAkB,EAClB,QAAQ,EACR,cAAc,EACd,eAAe,EACf,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -3,6 +3,7 @@
 // there's one implementation: one crypto path, one error class, one HTTP +
 // type surface.
 export { hmacSha256Hex, randomHex, timingSafeEqualHex } from './crypto.js';
+export { fromBase64, toBase64, toBase64Url } from './encoding.js';
 export { AgentbankError } from './errors.js';
-export { buildUrl, sendJson, toError } from './http.js';
+export { DEFAULT_TIMEOUT_MS, buildUrl, sendJson, toError, } from './http.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,gBAAgB;AAChB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAuC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,gBAAgB;AAChB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAIlB,QAAQ,EACR,QAAQ,EACR,OAAO,GACR,MAAM,WAAW,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curless/agentbank-core",
-  "version": "0.0.2",
+  "version": "0.1.1",
   "description": "Shared runtime primitives for the agentbank SDKs. Edge-safe crypto (Web Crypto API, no node:crypto) so the buyer / merchant / protocol SDKs run unchanged on Node 18+, Vercel Edge, Cloudflare Workers and Deno.",
   "license": "MIT",
   "type": "module",
@@ -24,7 +24,7 @@
   "devDependencies": {
     "@types/node": "^22.10.1",
     "typescript": "^5.6.3",
-    "vitest": "^2.1.9"
+    "vitest": "^3.2.6"
   },
   "engines": {
     "node": ">=18"
@@ -36,6 +36,12 @@
     "edge-runtime",
     "hmac"
   ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/robin-ruan/agentbank.git",
+    "directory": "packages/core"
+  },
+  "author": "robin",
   "scripts": {
     "build": "tsc",
     "typecheck": "tsc --noEmit",